great-cto

See the work. Trace the decisions.

Actual 3.70 interface. The graph uses an offline controller run with stub responses, not live models.

Legacy 3.70.1 command. See the verified distribution boundary below for current activation limits.

npx great-cto init

Website · One real run → · Blog · Changelog

Русский · 简体中文 · 繁體中文 · 日本語 · 한국어 · Español · Português · Deutsch · Français

---

Keep the task, its checks and your next decision connected.

great_cto coordinates Claude Code workflows and experimental controlled Codex runs through explicit stages, review and gates. The local board brings tasks, recorded execution, project documents and consumption into one workspace. Missing evidence stays unknown; a successful worker is not proof that a task was accepted, merged or deployed. You use your own provider account; great_cto is MIT and bills nothing.

Project focus presents eight core roles plus the selected project's required reviewers. The full catalog of 73 agents remains available. Catalog availability is not proof of execution or expertise.

Quick start

Verified distribution boundary (ADR-045): this implementation replaces mutable installers with verified artifact admission. init, native plugin refresh and automatic companion installation currently refuse activation. Plain npm self-update needs the separately configured verifier and a signed release artifact set. This is not evidence of an installed or published update. See verified updates for the supported boundary. The commands below describe the legacy 3.70.1 installation flow; they are not an activation route for this implementation.

npx great-cto init

Restart Claude Code. Day to day there are three things:

/start takes a new product or a task in an existing project and picks the workflow itself. /resume continues only what you already approved; a pending decision still waits for you. Everything else — /review, /spec, /save, /digest and the rest — is there when you need it: all commands.

Setting up through an AI agent? Paste the one prompt in Quick start for AI agents into Claude Code or Codex.

One project, five views

Run great-cto board to open the local board, normally at localhost:3141. Readings such as unverifiable, unmeasured and unavailable are not passes.

Execution shows controller-recorded causal history for controlled runs, including attempts, checks, verification, gates and repair. Native and legacy sessions stay partial or unavailable; missing edges are not inferred. This is not a live terminal or workflow editor. The sample graph comes from offline stub responses, not models.

A role verdict is not independent-review proof. Merge, release and deployment need their own evidence; unknown is not zero or pass.

Documents keep their original language. The application interface is English. The diagram describes declared architecture, not a running task.

These screenshots use isolated synthetic ACME records. They do not measure host quality, acceptance rate or quality uplift. Capture contract.

Eight core roles, task-dependent specialists

These are responsibility contracts, not eight mandatory model calls or eight concurrent agents. Project focus is a presentation view; it does not remove specialists, change dispatch or waive required checks. Risk-specific reviewers remain governed by project policy.

Web frontends and mobile builds are not deployed by devops: it hands them to release-manager, which builds once from the CI-green commit, stages the build on a preview URL or an internal test track, has e2e-test-engineer test that exact build, and promotes or prepares the store submission only after gate:release. A release counts as done when its receipt in .great_cto/releases/ names the build, the tests, the landed version and the rollback. /release ship <web|ios|android|ota> starts it.

Focused engineering context

Five versioned, opt-in domain pack candidates cover four focus areas:

Packs add engineering context. They do not broaden permissions or change required-reviewer routing. Their presence does not prove invocation, expertise or better outcomes. No quality uplift from matched core-versus-pack trials is established. Private project overlays are not part of the public showcase.

On OpenAI Codex

There are three distinct modes, not identical native integrations:

Mixed runs can assign roles to either CLI. Eligible review joins can inspect the same frozen tree concurrently; this is not two writers editing the same worktree. Both CLIs must be installed and authenticated. See the host guide for routing, recovery and manual-action boundaries.

In the legacy 3.70.1 installation flow, npx great-cto init --host codex gives Codex the skills, the MCP server and six safety guards as plugin hooks (approve them once: run codex in a terminal and choose Trust all and continue). An ordinary Codex plugin session does not automatically run this project's native Claude command/role lifecycle. The Codex installation has no native plugin surface for these slash commands or role agents. The remaining Claude workflow hooks do not silently run there. Start the controlled pipeline through the CLI instead:

great-cto run "add Google login" --host codex --allow src,tests,docs
great-cto status --host codex
great-cto resume --host codex

The legacy 3.70.1 plugin refresh is explicit by default (great-cto upgrade codex). In this implementation, native refresh and timer enable refuse before mutation pending a verified no-fetch activation contract. Previously installed timers retain their existing code until an authorized migration. In the legacy 3.70.1 macOS flow, sh scripts/codex-auto-update.sh enable opts into a six-hour per-user timer; status inspects it and disable removes it. Each tick validates the Git marketplace origin before asking Codex to upgrade. It follows the configured Git ref, not npm releases, and changed hooks still need host review in a new session. Details, mixed runs and Codex as the second reviewer: Codex host guide.

When it stops you

One line in .great_cto/PROJECT.md:

Regulated products — fintech, healthcare, gov — keep their security, compliance and ship gates at every level. A production web promote, a store submission or a production OTA update always stops at gate:release, auto included. How the gates work.

Numbers, measured

These are historical observations, not a benchmark of the current two-host pipeline or domain packs. No quality-uplift percentage is established. Domain packs remain opt-in; their presence does not prove expertise or better outcomes.

Limitations

For one builder, not a team; not a hosted app builder — it needs your coding agent; not a CI/CD system; compliance scaffolds are starting points, not certifications; LLM output is not deterministic. The honest version of each, and what it refuses to claim: docs/DETAILS.md.

Learn more

Docs · Getting started · Commands · Gates · Agents · FAQ · Everything else · Issues · Security · Contributing · Privacy — telemetry is off by default

MIT — LICENSE. Built by @avelikiy. If it saved you time, a star helps other solo builders find it.